# Ansible Galaxy IPs

**URL:** <https://forum.ansible.com/t/ansible-galaxy-ips/5243>\
**Category:** Get Help\
**Tags:** galaxy-ng\
**Created:** [May 1, 2024, 3:14pm UTC](https://forum.ansible.com/t/ansible-galaxy-ips/5243 "2024-05-01T15:14:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![krymson19](https://avatars.discourse-cdn.com/v4/letter/k/22d042/32.png) [@krymson19](https://forum.ansible.com/u/krymson19)\
**Post date:** [May 1, 2024, 3:14pm UTC](https://forum.ansible.com/t/ansible-galaxy-ips/5243/1 "2024-05-01T15:14:05Z")

</div>

Trying to pull down Ansible Galaxy roles. Getting errors. Is there a CIDR block to whitelist for Ansible Galaxy? I couldnt find any IPs to whitelist. Had my FW team whitelist [galaxy.ansible.com](http://galaxy.ansible.com) and still failing. Tried wget as well and couldnt download the .tar. Any help is appreciated.

Using ansible-galaxy  
ERROR! Failed to download collection tar from ‘default’ due to the following unforeseen error: \<urlopen error [Errno 104] Connection reset by peer\>. \<urlopen error [Errno 104] Connection reset by peer\>

Using wget  
GnuTLS: Error in the pull function.  
Unable to establish SSL connection.

---

<div class="post-metadata">

**Author:** ![chris](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/chris/32/293_2.png) [@chris](https://forum.ansible.com/u/chris)\
**Post date:** [May 1, 2024, 3:49pm UTC](https://forum.ansible.com/t/ansible-galaxy-ips/5243/2 "2024-05-01T15:49:31Z")

</div>

It looks like it is configured with round robin DNS?

```bash
dig galaxy.ansible.com +short
172.67.68.251
104.26.0.234
104.26.1.234

```

Try adding the IP addresses above to the allow list?

---

<div class="post-metadata">

**Author:** ![krymson19](https://avatars.discourse-cdn.com/v4/letter/k/22d042/32.png) [@krymson19](https://forum.ansible.com/u/krymson19)\
**Post date:** [May 1, 2024, 5:26pm UTC](https://forum.ansible.com/t/ansible-galaxy-ips/5243/3 "2024-05-01T17:26:36Z")

</div>

Same error after adding those to the FW.

ERROR! Failed to download collection tar from ‘default’ due to the following unforeseen error: \<urlopen error [Errno 104] Connection reset by peer\>. \<urlopen error [Errno 104] Connection reset by peer\>

---

<div class="post-metadata">

**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\
**Post date:** [May 1, 2024, 6:02pm UTC](https://forum.ansible.com/t/ansible-galaxy-ips/5243/4 "2024-05-01T18:02:38Z")

</div>

Downloads are served through aws s3, from `ansible-galaxy.s3.amazonaws.com`. The documentation we have indicates to not restrict based on IP, but based on hostnames, unless you have something that will continuously update rules based on the current resolution instead.

---

<div class="post-metadata">

**Author:** ![krymson19](https://avatars.discourse-cdn.com/v4/letter/k/22d042/32.png) [@krymson19](https://forum.ansible.com/u/krymson19)\
**Post date:** [May 7, 2024, 6:22pm UTC](https://forum.ansible.com/t/ansible-galaxy-ips/5243/5 "2024-05-07T18:22:00Z")

</div>

So I just need to have the FW team white list [ansible-galaxy.s3.amazonaws.com](http://ansible-galaxy.s3.amazonaws.com)? Tried having them \*.ansible.com, but that didnt work.